How to Write a Defensible Workplace Investigation Report in 2026
A 13-section operator's guide — post-Stericycle, post-McLaren Macomb, post-EEOC-rescission.
1. The investigation report is the evidence, not just a summary
In any Title VII, FEHA, or parallel-state harassment or discrimination lawsuit that reaches discovery, the investigation report is produced, studied, and cross-examined. It is the single most important document proving the Faragher v. City of Boca Raton (524 U.S. 775, 1998) and Burlington Industries, Inc. v. Ellerth (524 U.S. 742, 1998) affirmative defense — the employer's proof that it exercised reasonable care to promptly correct any harassing behavior. A complete, well-documented report is the core of the defense; a sloppy or incomplete one undermines it. The first rule of drafting the report is to assume it will be read by opposing counsel, a plaintiff, a jury, the EEOC, and a judge — because it will be.
Three recurring structural failures cause reports to fail in litigation. First, the investigator overreaches into legal conclusions the investigator is not qualified or authorized to make — writing "the respondent harassed the complainant" instead of finding that specific conduct occurred. Second, the report is late: the lag between complaint receipt and investigation start, or between investigation start and written report, exceeds what a jury will treat as prompt. Third, the report is inconsistent with interview notes: the summary adds or omits facts from what the interviews actually captured. All three are avoidable with discipline. The generator's default templates are structured to avoid all three.
2. Privilege posture is the first structural decision
An in-house HR investigation without any involvement of counsel has no attorney-client privilege. Every note, draft, and email is discoverable. An investigation conducted by in-house counsel may be privileged under Upjohn Co. v. United States (449 U.S. 383, 1981), but only if the significant-purpose test of In re Kellogg Brown and Root (756 F.3d 754, D.C. Cir. 2014) is satisfied — obtaining or providing legal advice must be one of the significant purposes of the investigation, not merely a post-hoc label. Outside counsel conducting the investigation at the employer's direction has the strongest privilege posture because the attorney-client relationship is clear and the interviewee's Upjohn warnings close the loop.
A third-party non-attorney investigator — typically a licensed private investigator retained by HR — receives no attorney-client privilege at all. The investigator's work may be protected under the work-product doctrine if retained by counsel in anticipation of litigation, but not otherwise. In California, Business and Professions Code Section 7520 requires a PI license for non-attorney external investigators conducting paid investigations, with an attorney-as-attorney exception. A non-attorney third-party retained to conduct a California workplace investigation without a PI license is likely operating unlawfully. The generator asks about investigator type up front and adjusts all the warnings, disclaimers, and privilege footers accordingly.
3. Upjohn warnings: the scripted notice that preserves privilege
Where privilege is claimed, the Upjohn warning is the scripted notice given to the employee-interviewee at the start of the interview. Four elements: (1) the attorney represents the company, not the employee individually; (2) the communication is privileged but the privilege belongs to the company, which may waive it without the employee's consent; (3) the employee should keep the communication confidential to protect the privilege; (4) participation is not required but the company may take employment action for refusal. Without the warning, the employee may later credibly claim they believed the attorney represented them, creating a joint-privilege problem that often forecloses unilateral company waiver. Omitting Upjohn warnings is the single most common way in-house investigations destroy their own privilege.
The warning is required only where privilege is being claimed. An in-house HR investigator who is not an attorney gives no Upjohn warning because no attorney-client privilege attaches to begin with. The generator inserts Upjohn warnings automatically when the investigator type is in-house counsel or outside counsel, and suppresses them for HR-only or third-party investigator tracks.
4. Weingarten and Garrity: when representation matters
In a unionized workplace, NLRB v. J. Weingarten, Inc. (420 U.S. 251, 1975) gives the employee the right to a union representative in an investigatory interview that the employee reasonably believes may result in discipline. The employer may grant the request, end the interview, or give the employee the choice between proceeding without representation or declining the interview. Denying a requested representative and proceeding anyway is an unfair labor practice. Weingarten rights currently apply only to unionized workforces — the NLRB briefly extended Weingarten to non-union employees in Epilepsy Foundation (331 NLRB 676, 2000) but reversed that extension in IBM Corp. (341 NLRB 1288, 2004).
For public-sector employees, Garrity v. New Jersey (385 U.S. 493, 1967) governs compelled statements in misconduct investigations. Where the public employer requires the employee to answer on threat of termination, the answers and any evidence derived from them are immunized from use in a criminal prosecution. The practical choice is between compelling the employee to answer (and losing criminal admissibility) or preserving criminal admissibility (and not compelling the employee). Garrity does not apply to private-sector employees because there is no state action. The generator flags Weingarten when a unionized workforce is indicated and Garrity when the matter is a public-sector misconduct investigation.
5. Stericycle and McLaren Macomb: the narrow-confidentiality rule still controls in 2026
The NLRB's August 2, 2023 decision in Stericycle, Inc. (372 NLRB No. 113) overruled Boeing and the Apogee Retail rule that had treated investigation-confidentiality instructions as categorically lawful. Under Stericycle, a workplace rule is presumptively unlawful if a reasonable employee subject to the rule and economically dependent on the employer could interpret it as chilling Section 7 rights. The employer may rebut by proving the rule advances a legitimate and substantial business interest that cannot be served by a more narrowly tailored rule. A blanket "keep this investigation confidential" instruction will almost always fail Stericycle. The permissible instruction is limited to the pendency of the open investigation, tied to specific interests (witness protection, evidence preservation, preventing collusion or retaliation), and expressly does not prevent the employee from talking with an attorney, a government agency, a union, or co-employees who may themselves be potential complainants.
McLaren Macomb (372 NLRB No. 58, February 21, 2023) reached parallel conclusions for severance-agreement confidentiality and non-disparagement clauses. The Trump administration in February 2025 rescinded General Counsel Memorandum 23-05, which had expansively interpreted McLaren Macomb, and rescinded other related GC memos later in 2025. The Board decisions themselves remain good law as of April 2026 — NLRB tradition requires three Board votes to overturn precedent, and the reconstituted Board confirmed December 18, 2025 has only a 2-1 Republican majority (Chairman Murphy and Member Mayer versus Member Prouty, whose term expires August 2026). A Sixth Circuit decision on September 18, 2024 affirmed McLaren Macomb's core holding as to unionized workplaces, adding circuit-court weight to the Board's rule. Employers drafting investigation reports today must assume Stericycle and McLaren Macomb are the operative standard. The generator inserts a Stericycle-compliant narrow confidentiality paragraph by default.
6. The EEOC 2024 harassment guidance was rescinded — but Bostock still controls
The EEOC's April 29, 2024 Enforcement Guidance on Harassment in the Workplace — the first comprehensive update in 25 years — addressed virtual harassment, LGBTQ+ protections post-Bostock v. Clayton County, pregnancy-related sexual harassment, and roughly 70 illustrative examples. On January 22, 2026, the EEOC voted 2-1 to rescind the entire 2024 Guidance. Chair Andrea Lucas moved the rescission with a second from Commissioner Brittany Panuccio; Commissioner Kotagal dissented on procedural grounds. A May 2025 federal district court decision had already vacated portions of the Guidance related to sexual orientation and gender identity on statutory-authority grounds. The rescission does not change the underlying statutes or Supreme Court precedent.
Bostock v. Clayton County (590 U.S. 644, 2020) is still Supreme Court precedent: Title VII's prohibition on sex discrimination includes discrimination on the basis of sexual orientation and gender identity. A harassment investigation must still address LGBTQ+-directed harassment as sex harassment. What has changed is the EEOC's interpretive overlay — specific examples involving misgendering, deadnaming, bathroom access, and similar conduct no longer have the Guidance's imprimatur as per-se unlawful conduct. Investigators should continue to treat such conduct as potentially unlawful on the facts of a specific matter while understanding that the EEOC is currently not offering pattern guidance. The generator's harassment variant tracks the rescinded status while applying Bostock directly.
7. Retaliation temporal-proximity analysis under Nassar but-for causation
Retaliation is now the largest EEOC charge category, appearing in roughly 60 percent of charges filed. It has distinct causation rules. University of Texas Southwestern Medical Center v. Nassar (570 U.S. 338, 2013) holds that Title VII retaliation plaintiffs must prove but-for causation — the adverse action would not have occurred but for the protected activity — rather than the motivating-factor standard applicable to some Title VII discrimination claims. Temporal proximity between protected activity and adverse action is the most commonly-pleaded circumstantial evidence of but-for causation. Circuit courts generally treat gaps under roughly two months as probative and gaps over three to six months as insufficient alone without additional corroborating evidence.
The retaliation variant of the generator produces an explicit four-date timeline: (1) date of protected activity; (2) date the respondent or decisionmaker learned of the protected activity — knowledge is a separate causation predicate, and no knowledge means no retaliation regardless of proximity; (3) date of the adverse employment action; (4) days elapsed between employer knowledge and adverse action. The investigator's analysis of whether the temporal proximity is consistent or inconsistent with the respondent's stated legitimate non-retaliatory reason goes in the narrative findings. This structure applies whether the finding is substantiated, unsubstantiated, or inconclusive — the record supports the conclusion either way.
8. Credibility matrix: plausibility, demeanor, corroboration, motive, past record
Where the investigation is a credibility contest — the complainant says one thing, the respondent says another, and the witnesses are divided or unavailable — the investigator must make a credibility determination per witness and document the basis. The conventional five-factor framework tracks long-established employment-law practice and mirrors the factors administrative law judges and the EEOC use internally. Plausibility: does the account make sense on its face, given what else is known. Demeanor: how did the witness present during the interview (but demeanor alone is weak and courts have cautioned against it as a primary basis). Corroboration: what other evidence supports or contradicts the account — documents, emails, texts, other witnesses, physical evidence. Motive to fabricate: does the witness have a reason to lie in either direction. Past record: does the witness have a history of truthful or untruthful statements, disciplinary history, or prior complaints.
Each witness gets a line in the credibility matrix with a brief justification. The investigator's credibility determination is the factual basis for the substantiated / unsubstantiated / inconclusive finding; the determinations should be consistent with the findings (if the complainant is credited and the respondent is not, the allegation is substantiated; if credibility is divided and corroboration is absent, the allegation is inconclusive). Inconsistencies between credibility and findings are a common cross-examination target. The generator includes an editable credibility matrix and a consistency check.
9. Substantiated, unsubstantiated, inconclusive — not legal conclusions
Findings should be factual, not legal. For each discrete allegation, the investigator reaches one of three findings: substantiated (a preponderance of the evidence supports the allegation), unsubstantiated (a preponderance does not support the allegation), or inconclusive (the evidence is insufficient to reach either conclusion, typically a direct credibility contest with no corroboration). "Substantiated" means the specific conduct occurred, not that it was unlawful. Writing "the respondent harassed the complainant" or "the respondent retaliated against the complainant" confuses factual findings with legal conclusions and puts the investigator into the role of applying the law, which is not the investigator's job.
HR, legal, or the decisionmaker reaches the legal conclusion by applying the company's policy and the relevant statute to the investigator's factual findings. That separation is important in litigation — when the investigator is called as a witness, the investigator testifies to what they found happened, and a separate policy-application witness testifies to the disciplinary decision. Collapsing them undermines the defense. The generator's findings matrix enforces the substantiated / unsubstantiated / inconclusive framework and requires an evidence-based justification for each finding.
10. Recording consent: twelve all-party states and how they change interview practice
Twelve states require all-party consent for recording a private conversation: California, Connecticut, Delaware, Florida, Illinois, Maryland, Massachusetts, Montana, Nevada, New Hampshire, Pennsylvania, and Washington. Michigan's status is contested. The remaining states require only one-party consent. If the investigation interview is being recorded — audio or video, by human or by AI meeting transcription — every participant in an all-party state must consent before recording begins. Recording without consent in an all-party state can be criminal (Illinois eavesdropping is a Class 4 felony; California Penal Code Section 632 carries up to a year in jail and a $2,500 fine). In hybrid meetings where participants are in different states, the conservative rule is to apply the strictest standard among the participants.
For workplace investigations specifically, the common practice in all-party states is to request consent on the record at the start of the interview, log the consent, and proceed. If the interviewee declines, the investigator conducts the interview unrecorded and takes contemporaneous notes. The NLRB has held in some cases that employee covert recording is protected concerted activity under Section 7, which complicates employer discipline for employee secret recordings — but does not affect employer-side recording, which still requires consent under state law. The generator flags the all-party-consent states and inserts the on-record consent script into the interview-methodology section.
11. CA SB 553 workplace-violence-prevention plan integration
California Senate Bill 553 (Lab. Code Section 6401.9, effective July 1, 2024) requires every covered California employer to establish, implement, and maintain a written Workplace Violence Prevention Plan (WVPP), to log every incident of workplace violence in a Violent Incident Log, and to train employees on the plan. Investigations conducted under the WVPP must be documented and the documentation must be retained for five years. The Violent Incident Log must capture, for each incident, the date, time, location, violence type (Type 1-4), weapons if any, consequences including law-enforcement contact, and corrective measures. A workplace investigation that includes any workplace-violence component — a physical altercation, a threat, a weapons incident, a sexual assault at work — must feed into the WVPP log in addition to the standard harassment or misconduct report. Cal/OSHA is required to adopt a permanent general-industry standard no later than December 31, 2026.
The generator flags the SB 553 integration automatically when California is selected and the workplace-violence checkbox is marked. The output includes a Violent Incident Log addendum with the statutorily-required fields pre-populated from the investigation intake.
12. Mandatory reporting and state-law parallels
Several states layer mandatory-reporting obligations onto workplace investigations. Suspected child abuse triggers mandated-reporter obligations in every state for designated professionals (teachers, healthcare workers, and in most states employees of any business that serves children). Elder abuse triggers similar obligations in most states. Regulated industries have distinct reporting duties — financial services (SAR/BSA filings), healthcare (Joint Commission, state licensing boards), education (Title IX parallel reporting where applicable after the 2024 and 2025 Title IX rulemaking litigation), and law enforcement (POST obligations). California FEHA separately requires that certain investigations be conducted by a qualified person; the CRD (formerly DFEH) has treated properly trained in-house HR as qualified for simpler matters and pushed toward outside counsel or a licensed PI for complex matters or C-suite respondents.
California AB 2188 (Gov. Code Section 12954, effective January 1, 2024) prohibits employment discrimination based on off-duty cannabis use and prohibits disciplinary action based on drug-test results showing only non-psychoactive cannabis metabolites (urine tests typically). If a misconduct investigation is premised in any part on an off-duty positive drug test, the AB 2188 limits must be honored — the investigator cannot treat the test alone as substantiating impairment or misconduct. The generator flags AB 2188 when California is selected and the cannabis-component checkbox is marked. Mandatory-reporting triggers are surfaced in the scorecard and the report's risk flags.
13. Record retention, final write-up, and corrective-action recommendation
Records retention is set by multiple overlapping rules. The EEOC minimum under 29 C.F.R. Section 1602.14 is one year from creation or the personnel action involved, whichever is later, tolled during an open charge. California Government Code Section 12946 requires four years for FEHA-covered records. New York practice is six years, coordinated with NY DOL audit windows. California SB 553 requires five years for violent-incident investigations. ADA-related medical records must be kept in a separate, confidential file for duration of employment plus one year. FMLA records are three years. Active litigation-hold memos toll all of these minimums until resolution. The generator sets retention at the longer of the applicable state floor and the federal EEOC minimum, with automatic extension for open charges or litigation holds.
The final write-up is organized as: preamble and scope, investigator qualifications and privilege posture, methodology (interviews conducted, evidence reviewed, recording status, representation present), allegations matrix (one row per allegation), factual findings per allegation with credibility analysis, retaliation timeline (retaliation variant only), corrective-action recommendation scaled to severity, record retention, investigator attestation and signature block. The corrective-action recommendation is calibrated to the severity and pattern — first substantiated finding of moderate misconduct typically warrants written discipline and training; pattern or serious substantiated findings warrant more severe discipline up to termination. The recommendation is just that — a recommendation — and the decisionmaker applies policy and reaches the disciplinary decision separately. That separation, again, protects the report from being attacked as a pre-judged disciplinary document.
Built by Derek Giordano · Part of Ultimate Design Tools
Informational only. Not legal advice. Consult counsel for your specific situation.